{"id":"CVE-2026-71321","aliases":["CLSA-2026-1788450984","CLSA-2026-1789598338","CLSA-2026-1792161460","CLSA-2026-1792161463","CLSA-2026-1792161485","CLSA-2026-1792161601","CLSA-2026-1792161604","CLSA-2026-1792161823","CLSA-2026-1792161826","CLSA-2026-1792161936","CLSA-2026-1792161939","CLSA-2026-1793661073","EUVD-2026-53658","GHSA-9pgf-384g-p7mv"],"status":"published","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00742,"percentile":0.55171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407","CWE-770"],"published":"2026-08-05T21:42:48Z","modified":"2026-11-03T02:45:02Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.5.1","3.21.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.2","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.6"}]}],"versions":["3.2.0","3.2.0-tuxcare.2","3.2.0-tuxcare.4","3.2.0-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.10","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9pgf-384g-p7mv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71321.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71321","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-71321","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:42:48.161Z","modified":"2026-08-06T13:44:59.314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53658","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:42:48Z","modified":"2026-08-06T13:44:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-9pgf-384g-p7mv","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","description":"### Impact\n\nThe internal island renderer endpoint (`/__nuxt_island/...`) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated `POST /__nuxt_island/\u003cname\u003e_\u003canything\u003e.json` with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, `destr`-parsed, and run through `ohash` before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low request rate is enough to degrade or stall the server. No valid hash and no authentication are required.\n\n### Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. The island handler now enforces a raw body-size cap (`413`) and a JSON nesting-depth cap (`400`) before parsing or hashing, so oversized or deeply nested input is rejected cheaply.\n\n### Workarounds\n\nPut a small request-body limit in front of `/__nuxt_island/` at your reverse proxy / edge (islands legitimately send only a compact props payload), or disable server components if unused.","status":"published","published":"2026-08-05T21:43:03Z","modified":"2026-08-05T21:43:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71321","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T22:17:08.507Z","modified":"2026-09-08T20:51:43.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71321","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:42:48.161Z","modified":"2026-10-28T02:31:07.913565234Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-9pgf-384g-p7mv","title":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation","description":"### Impact\n\nThe internal island renderer endpoint (`/__nuxt_island/...`) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated `POST /__nuxt_island/\u003cname\u003e_\u003canything\u003e.json` with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, `destr`-parsed, and run through `ohash` before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low request rate is enough to degrade or stall the server. No valid hash and no authentication are required.\n\n### Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. The island handler now enforces a raw body-size cap (`413`) and a JSON nesting-depth cap (`400`) before parsing or hashing, so oversized or deeply nested input is rejected cheaply.\n\n### Workarounds\n\nPut a small request-body limit in front of `/__nuxt_island/` at your reverse proxy / edge (islands legitimately send only a compact props payload), or disable server components if unused.","status":"published","published":"2026-08-05T21:43:03Z","modified":"2026-08-05T21:55:59.649282Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"CLSA-2026-1788450984","title":"TuxCare security update for nuxt (11 CVEs)","description":"TuxCare rebuilt nuxt to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-09-03T15:56:24Z","modified":"2026-10-15T09:48:03.152914241Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789598338","title":"TuxCare security update for nuxt (7 CVEs)","description":"TuxCare rebuilt nuxt to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-09-16T22:38:58Z","modified":"2026-10-15T09:47:56.237986037Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792161460","title":"TuxCare security update for @nuxt/kit (11 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:37:40Z","modified":"2026-10-16T16:31:03.072757342Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161463","title":"TuxCare security update for @nuxt/kit (7 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:37:43Z","modified":"2026-10-16T16:30:58.380403359Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161485","title":"TuxCare security update for @nuxt/rspack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:38:05Z","modified":"2026-10-16T16:30:59.69839942Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161601","title":"TuxCare security update for @nuxt/schema (11 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:40:01Z","modified":"2026-10-16T16:31:05.866570588Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161604","title":"TuxCare security update for @nuxt/schema (7 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:40:04Z","modified":"2026-10-16T16:31:05.873102631Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161823","title":"TuxCare security update for @nuxt/vite-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:43:43Z","modified":"2026-10-16T16:30:34.584872899Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161826","title":"TuxCare security update for @nuxt/vite-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:43:46Z","modified":"2026-10-16T16:30:32.87761218Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161936","title":"TuxCare security update for @nuxt/webpack-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:45:36Z","modified":"2026-10-16T16:31:30.28168697Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161939","title":"TuxCare security update for @nuxt/webpack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:45:39Z","modified":"2026-10-16T16:31:19.053836641Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1793661073","title":"TuxCare security update for nuxi (2 CVEs)","description":"TuxCare rebuilt nuxi to address 2 CVEs. Fixed in 3.2.0-tuxcare.6.","status":"published","published":"2026-11-03T00:11:14Z","modified":"2026-11-03T02:45:02.355656232Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}